feat(openapi): complete upload preview and UI evidence

apps/admin-api/src/app.rs

@@ -4,6 +4,7 @@ use axum::{
     middleware,
     routing::{delete, get, post},
 };
+use crank_artifacts::MAX_ARTIFACT_BYTES;
 
 use crate::{
     auth::{
@@ -48,7 +49,11 @@ use crate::{
 pub fn build_app(state: AppState) -> Router {
     let workspace_router = Router::new()
         .route("/operations", get(list_operations).post(create_operation))
-        .route("/imports/openapi/preview", post(preview_openapi_import))
+        .route(
+            "/imports/openapi/preview",
+            post(preview_openapi_import)
+                .layer(DefaultBodyLimit::max(MAX_ARTIFACT_BYTES + 32 * 1024)),
+        )
         .route(
             "/imports/openapi/{job_id}/create",
             post(create_openapi_import),

apps/admin-api/src/dto.rs

@@ -524,9 +524,17 @@ pub struct LegacyYamlOperationDocument {
     pub operation: RegistryOperation,
 }
 
-#[derive(Clone, Debug, Deserialize)]
-pub struct OpenApiImportPreviewPayload {
-    pub document: String,
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum OpenApiUploadLocale {
+    En,
+    Ru,
+}
+
+#[derive(Clone, Debug)]
+pub struct OpenApiUpload {
+    pub bytes: Vec<u8>,
+    pub mime_type: String,
+    pub locale: OpenApiUploadLocale,
 }
 
 #[derive(Clone, Debug, Serialize)]

apps/admin-api/src/error.rs

@@ -11,6 +11,7 @@ use serde_json::{Value, json};
 use thiserror::Error;
 use tracing::{error, warn};
 
+use crate::dto::OpenApiUploadLocale;
 use crate::storage::StorageError;
 
 #[derive(Debug, Error)]
@@ -96,6 +97,112 @@ impl ApiError {
         }
     }
 
+    pub(crate) fn openapi_upload(locale: OpenApiUploadLocale, code: &'static str) -> Self {
+        let russian = locale == OpenApiUploadLocale::Ru;
+        let message = match (russian, code) {
+            (_, "file_too_large") => {
+                if russian {
+                    "файл OpenAPI превышает лимит 256 КиБ"
+                } else {
+                    "OpenAPI file exceeds the 256 KiB limit"
+                }
+            }
+            (_, "empty_file") => {
+                if russian {
+                    "файл OpenAPI не должен быть пустым"
+                } else {
+                    "OpenAPI file must not be empty"
+                }
+            }
+            (_, "invalid_utf8") => {
+                if russian {
+                    "файл OpenAPI должен быть в UTF-8"
+                } else {
+                    "OpenAPI file must be UTF-8"
+                }
+            }
+            (_, "invalid_media_type") => {
+                if russian {
+                    "тип файла OpenAPI не поддерживается"
+                } else {
+                    "OpenAPI file type is not supported"
+                }
+            }
+            (_, "invalid_document") => {
+                if russian {
+                    "некорректный или неподдерживаемый документ OpenAPI"
+                } else {
+                    "OpenAPI document is invalid or unsupported"
+                }
+            }
+            (_, "no_methods") => {
+                if russian {
+                    "документ OpenAPI не содержит поддерживаемых методов"
+                } else {
+                    "OpenAPI document contains no supported methods"
+                }
+            }
+            (_, "source_integrity") => {
+                if russian {
+                    "проверка целостности источника OpenAPI не пройдена"
+                } else {
+                    "OpenAPI source integrity verification failed"
+                }
+            }
+            (_, "source_unavailable") => {
+                if russian {
+                    "источник OpenAPI недоступен"
+                } else {
+                    "OpenAPI source is unavailable"
+                }
+            }
+            (_, "parser_unavailable") | (_, "storage_unavailable") => {
+                if russian {
+                    "обработка OpenAPI временно недоступна"
+                } else {
+                    "OpenAPI processing is temporarily unavailable"
+                }
+            }
+            _ => {
+                if russian {
+                    "некорректная multipart-загрузка OpenAPI"
+                } else {
+                    "invalid OpenAPI multipart upload"
+                }
+            }
+        };
+        let context = json!({ "error_code": format!("openapi_upload.{code}") });
+        if code == "file_too_large" {
+            Self::PayloadTooLarge {
+                message: message.to_owned(),
+                context: Some(context),
+            }
+        } else if matches!(code, "storage_unavailable" | "parser_unavailable") {
+            Self::Internal {
+                message: message.to_owned(),
+                context: Some(context),
+            }
+        } else if matches!(code, "source_integrity" | "source_unavailable") {
+            Self::Unprocessable {
+                message: message.to_owned(),
+                context: Some(context),
+            }
+        } else {
+            Self::Validation {
+                message: message.to_owned(),
+                context: Some(context),
+            }
+        }
+    }
+
+    pub(crate) fn source_unavailable() -> Self {
+        Self::openapi_upload(OpenApiUploadLocale::En, "source_unavailable")
+    }
+
+    pub(crate) fn source_integrity() -> Self {
+        Self::openapi_upload(OpenApiUploadLocale::En, "source_integrity")
+    }
+
     pub(crate) fn rate_limited_with_context(message: impl Into<String>, context: Value) -> Self {
         Self::RateLimited {
             message: message.into(),
@@ -588,17 +695,15 @@ impl From<RegistryError> for ApiError {
                 format!("import job {job_id} was already applied with different parameters"),
                 json!({ "job_id": job_id }),
             ),
-            RegistryError::SourceNotFound { source_id } => Self::not_found_with_context(
+            RegistryError::SourceNotFound { .. } => Self::not_found_with_context(
                 "artifact source was not found",
                 json!({
-                    "source_id": source_id,
                     "error_code": "artifact_source_not_found"
                 }),
             ),
-            RegistryError::SourceConflict { source_id } => Self::conflict_with_context(
+            RegistryError::SourceConflict { .. } => Self::conflict_with_context(
                 "artifact source metadata or lifecycle conflicts with the request",
                 json!({
-                    "source_id": source_id,
                     "error_code": "artifact_source_conflict",
                     "recovery": "reload"
                 }),

apps/admin-api/src/main.rs

@@ -204,6 +204,7 @@ async fn run(
         verified_startup_secret_crypto(&registry, config.runtime.master_key.expose_secret())
             .await?;
     let artifact_store = open_reconciliation_store(config.storage_root.clone()).await?;
+    registry.delete_expired_import_jobs().await?;
     let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new_with_limits(
         config.runtime.outbound.allowed_hosts.clone(),
         config.runtime.outbound.denied_hosts.clone(),
@@ -224,6 +225,7 @@ async fn run(
         secret_crypto,
         runtime,
     )
+    .with_artifact_store(artifact_store.clone())
     .with_public_base_url(base_url)
     .with_outbound_http_policy(outbound_http_policy)
     .with_identity_provider(std::sync::Arc::new(identity_provider))

apps/admin-api/src/routes/imports.rs

@@ -1,13 +1,16 @@
 use axum::{
     Json,
-    extract::{Path, State},
+    extract::{Multipart, Path, State, multipart::MultipartRejection},
+    http::HeaderMap,
+    response::IntoResponse,
 };
+use crank_artifacts::MAX_ARTIFACT_BYTES;
 use serde::Deserialize;
 use serde_json::{Value, json};
 
 use crate::{
     error::ApiError,
-    service::{OpenApiImportCreatePayload, OpenApiImportPreviewPayload},
+    service::{OpenApiImportCreatePayload, OpenApiUpload, OpenApiUploadLocale},
     state::AppState,
 };
 
@@ -25,15 +28,118 @@ pub struct WorkspaceImportPath {
 pub async fn preview_openapi_import(
     Path(path): Path<WorkspacePath>,
     State(state): State<AppState>,
-    Json(payload): Json<OpenApiImportPreviewPayload>,
+    headers: HeaderMap,
+    multipart: Result<Multipart, MultipartRejection>,
 ) -> Result<Json<Value>, ApiError> {
+    let locale = openapi_upload_locale(&headers);
+    let upload = parse_openapi_upload(
+        multipart.map_err(|rejection| multipart_rejection(locale, rejection))?,
+        locale,
+    )
+    .await?;
     let preview = state
         .service
-        .preview_openapi_import(&path.workspace_id.as_str().into(), payload)
+        .preview_openapi_import(&path.workspace_id.as_str().into(), upload)
         .await?;
     Ok(Json(json!(preview)))
 }
 
+fn multipart_rejection(locale: OpenApiUploadLocale, rejection: MultipartRejection) -> ApiError {
+    if rejection.into_response().status() == axum::http::StatusCode::PAYLOAD_TOO_LARGE {
+        ApiError::openapi_upload(locale, "file_too_large")
+    } else {
+        ApiError::openapi_upload(locale, "malformed_multipart")
+    }
+}
+
+async fn parse_openapi_upload(
+    mut multipart: Multipart,
+    locale: OpenApiUploadLocale,
+) -> Result<OpenApiUpload, ApiError> {
+    let mut upload = None;
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| ApiError::openapi_upload(locale, "malformed_multipart"))?
+    {
+        if upload.is_some() || field.name() != Some("file") {
+            return Err(ApiError::openapi_upload(locale, "malformed_multipart"));
+        }
+        let filename = field
+            .file_name()
+            .ok_or_else(|| ApiError::openapi_upload(locale, "invalid_filename"))?;
+        let mime_type = field
+            .content_type()
+            .map(ToString::to_string)
+            .ok_or_else(|| ApiError::openapi_upload(locale, "invalid_media_type"))?;
+        if !valid_upload_type(filename, &mime_type) {
+            return Err(ApiError::openapi_upload(locale, "invalid_media_type"));
+        }
+        let mut bytes = Vec::with_capacity(8 * 1024);
+        let mut field = field;
+        while let Some(chunk) = field
+            .chunk()
+            .await
+            .map_err(|_| ApiError::openapi_upload(locale, "malformed_multipart"))?
+        {
+            if bytes.len().saturating_add(chunk.len()) > MAX_ARTIFACT_BYTES {
+                return Err(ApiError::openapi_upload(locale, "file_too_large"));
+            }
+            bytes.extend_from_slice(&chunk);
+        }
+        if bytes.is_empty() {
+            return Err(ApiError::openapi_upload(locale, "empty_file"));
+        }
+        if std::str::from_utf8(&bytes).is_err() {
+            return Err(ApiError::openapi_upload(locale, "invalid_utf8"));
+        }
+        upload = Some(OpenApiUpload {
+            bytes,
+            mime_type,
+            locale,
+        });
+    }
+    upload.ok_or_else(|| ApiError::openapi_upload(locale, "missing_file"))
+}
+
+fn valid_upload_type(filename: &str, mime_type: &str) -> bool {
+    let filename = filename.to_ascii_lowercase();
+    let mime_type = mime_type.to_ascii_lowercase();
+    match filename.rsplit_once('.') {
+        Some((_, "yaml" | "yml")) => matches!(
+            mime_type.as_str(),
+            "application/yaml"
+                | "application/x-yaml"
+                | "text/yaml"
+                | "text/x-yaml"
+                | "application/octet-stream"
+        ),
+        Some((_, "json")) => matches!(
+            mime_type.as_str(),
+            "application/json" | "application/openapi+json" | "application/octet-stream"
+        ),
+        _ => false,
+    }
+}
+
+fn openapi_upload_locale(headers: &HeaderMap) -> OpenApiUploadLocale {
+    let prefers_russian = headers
+        .get("accept-language")
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| {
+            value.split(',').any(|range| {
+                let language = range.split(';').next().unwrap_or_default().trim();
+                language.eq_ignore_ascii_case("ru")
+                    || language.to_ascii_lowercase().starts_with("ru-")
+            })
+        });
+    if prefers_russian {
+        OpenApiUploadLocale::Ru
+    } else {
+        OpenApiUploadLocale::En
+    }
+}
+
 pub async fn create_openapi_import(
     Path(path): Path<WorkspaceImportPath>,
     State(state): State<AppState>,

apps/admin-api/src/service.rs

@@ -3,6 +3,7 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use crank_artifacts::ArtifactStore;
 use crank_core::{
     AuditActor, AuditEvent, AuditEventId, AuditSink, AuditTarget, AuditTargetKind, AuthProfile,
     CapabilityProfile, CommunityCapabilityProfile, CorrelationContext, EditionCapabilities,
@@ -57,6 +58,7 @@ use operation_validation::{
 #[derive(Clone)]
 pub struct AdminService {
     registry: PostgresRegistry,
+    artifact_store: Arc<ArtifactStore>,
     runtime: RuntimeExecutor,
     storage: LocalArtifactStorage,
     auth_settings: AuthSettings,
@@ -72,6 +74,7 @@ pub struct AdminService {
 pub struct AdminServiceBuilder {
     registry: PostgresRegistry,
     storage_root: PathBuf,
+    artifact_store: Option<ArtifactStore>,
     auth_settings: AuthSettings,
     secret_crypto: SecretCrypto,
     runtime: RuntimeExecutor,
@@ -201,6 +204,7 @@ impl AdminServiceBuilder {
         Self {
             registry,
             storage_root,
+            artifact_store: None,
             auth_settings,
             secret_crypto,
             runtime,
@@ -223,6 +227,14 @@ impl AdminServiceBuilder {
         self
     }
 
+    /// Reuses the process-wide immutable artifact authority for OpenAPI
+    /// ingress and reconciliation. Tests may omit this and use their private
+    /// storage root instead.
+    pub fn with_artifact_store(mut self, artifact_store: ArtifactStore) -> Self {
+        self.artifact_store = Some(artifact_store);
+        self
+    }
+
     pub fn with_public_base_url(mut self, public_base_url: String) -> Self {
         self.public_base_url = public_base_url.trim_end_matches('/').to_owned();
         self
@@ -252,6 +264,10 @@ impl AdminServiceBuilder {
     pub fn build(self) -> AdminService {
         AdminService {
             registry: self.registry,
+            artifact_store: Arc::new(
+                self.artifact_store
+                    .unwrap_or_else(|| ArtifactStore::new(&self.storage_root)),
+            ),
             runtime: self.runtime,
             storage: LocalArtifactStorage::new(self.storage_root),
             auth_settings: self.auth_settings,

apps/admin-api/src/service/imports.rs

@@ -1,5 +1,6 @@
 use std::collections::{BTreeMap, BTreeSet};
 
+use crank_artifacts::{ArtifactError, MAX_ARTIFACT_BYTES};
 use crank_core::{
     ExecutionConfig, OperationSecurityLevel, Protocol, ToolQualityFinding, ToolQualitySeverity,
     WorkspaceId,
@@ -8,8 +9,10 @@ use crank_import::rest::{
     ImportFinding, ImportFindingSeverity, ImportOperationCandidate, operation_draft_from_candidate,
 };
 use crank_registry::{
-    ApplyImportJobRequest, CreateImportJobRequest, ImportConflictMode, ImportJobId, ImportJobKind,
-    ImportJobStatus, ImportOperationDraft,
+    ApplyImportJobRequest, ArtifactSourceId, ArtifactSourceSensitivity,
+    CreateArtifactSourceRequest, CreateImportJobRequest, DetachArtifactSourceRequest,
+    ImportConflictMode, ImportJobApplyResult, ImportJobId, ImportJobKind, ImportJobSourceEnvelope,
+    ImportJobStatus, ImportOperationDraft, RegistryError,
 };
 use serde_json::json;
 use sha2::{Digest, Sha256};
@@ -20,30 +23,83 @@ use crate::{
     error::ApiError,
     service::{
         AdminService, OpenApiImportCreatePayload, OpenApiImportCreateResponse,
-        OpenApiImportCreatedOperation, OpenApiImportPreviewPayload, OpenApiImportPreviewResponse,
-        OpenApiImportSkippedOperation, OperationPayload, new_prefixed_id,
+        OpenApiImportCreatedOperation, OpenApiImportPreviewResponse, OpenApiImportSkippedOperation,
+        OpenApiUpload, OpenApiUploadLocale, OperationPayload, new_prefixed_id,
     },
 };
 
 const IMPORT_JOB_TTL_HOURS: i64 = 24;
 
 impl AdminService {
-    #[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str()))]
+    #[instrument(skip(self, upload), fields(workspace_id = %workspace_id.as_str()))]
     pub async fn preview_openapi_import(
         &self,
         workspace_id: &WorkspaceId,
-        payload: OpenApiImportPreviewPayload,
+        upload: OpenApiUpload,
     ) -> Result<OpenApiImportPreviewResponse, ApiError> {
         self.ensure_workspace_exists(workspace_id).await?;
-        let _ = self.registry.delete_expired_import_jobs().await;
+        self.registry.delete_expired_import_jobs().await?;
 
-        let preview = crank_import::rest::preview_document(&payload.document)
-            .map_err(|error| ApiError::validation(error.to_string()))?;
+        validate_openapi_upload(&upload)?;
+        let OpenApiUpload {
+            bytes,
+            mime_type,
+            locale,
+        } = upload;
+        let store = self.artifact_store.clone();
+        let artifact = tokio::task::spawn_blocking(move || store.put_registered(&bytes))
+            .await
+            .map_err(|_| ApiError::openapi_upload(locale, "storage_unavailable"))?
+            .map_err(|error| artifact_error(locale, error))?;
         let now = OffsetDateTime::now_utc();
         let expires_at = now + Duration::hours(IMPORT_JOB_TTL_HOURS);
         let job_id = ImportJobId::new(new_prefixed_id("imp"));
-        let preview_payload = serde_json::to_value(&preview)
+        let source_id = ArtifactSourceId::new(new_prefixed_id("src_openapi"));
+        let source = self
+            .registry
+            .create_artifact_source(CreateArtifactSourceRequest {
+                workspace_id,
+                source_id: &source_id,
+                artifact: &artifact,
+                mime_type: &mime_type,
+                sensitivity: ArtifactSourceSensitivity::Internal,
+                created_at: now,
+            })
+            .await?;
+        let mut detach_guard = SourceDetachGuard::new(
+            self.registry.clone(),
+            workspace_id.clone(),
+            source_id.clone(),
+            source.updated_at,
+        );
+        let verified = self
+            .registry
+            .read_artifact_source(&self.artifact_store, workspace_id, &source_id)
+            .await?;
+        if verified.source.blob.artifact_ref != *artifact.artifact_ref() {
+            return Err(ApiError::openapi_upload(locale, "source_integrity"));
+        }
+        let preview = parse_verified_preview(verified.bytes, locale).await?;
+        if preview
+            .groups
+            .iter()
+            .all(|group| group.operations.is_empty())
+        {
+            return Err(ApiError::openapi_upload(locale, "no_methods"));
+        }
+        let source_envelope = ImportJobSourceEnvelope {
+            source_id,
+            digest: artifact.artifact_ref().clone(),
+        };
+        let preview_value = serde_json::to_value(&preview)
             .map_err(|error| ApiError::internal(error.to_string()))?;
+        let preview_payload = json!({
+            "source": {
+                "source_id": source_envelope.source_id.as_str(),
+                "digest": source_envelope.digest.as_str(),
+            },
+            "preview": preview_value,
+        });
 
         self.registry
             .create_import_job(CreateImportJobRequest {
@@ -53,11 +109,13 @@ impl AdminService {
                 source_format: &preview.source.format,
                 source_version: preview.source.version.as_deref(),
                 status: ImportJobStatus::Pending,
+                source: &source_envelope,
                 preview_payload: &preview_payload,
                 created_at: &now,
                 expires_at: &expires_at,
             })
             .await?;
+        detach_guard.disarm();
 
         Ok(OpenApiImportPreviewResponse {
             job_id: job_id.as_str().to_owned(),
@@ -76,7 +134,7 @@ impl AdminService {
         payload: OpenApiImportCreatePayload,
     ) -> Result<OpenApiImportCreateResponse, ApiError> {
         self.ensure_workspace_exists(workspace_id).await?;
-        let _ = self.registry.delete_expired_import_jobs().await;
+        self.registry.delete_expired_import_jobs().await?;
 
         if !matches!(payload.conflict_mode.as_str(), "skip" | "rename") {
             return Err(ApiError::validation(
@@ -101,13 +159,6 @@ impl AdminService {
             return Err(ApiError::validation("import job kind is not openapi"));
         }
 
-        let stored_preview = job
-            .preview_payload
-            .get("preview")
-            .cloned()
-            .unwrap_or_else(|| job.preview_payload.clone());
-        let preview: crank_import::rest::ImportPreview = serde_json::from_value(stored_preview)
-            .map_err(|error| ApiError::internal(error.to_string()))?;
         let selected = payload
             .selected_operation_keys
             .iter()
@@ -118,7 +169,38 @@ impl AdminService {
                 "selected_operation_keys must contain at least one operation",
             ));
         }
+        let finished_at = OffsetDateTime::now_utc();
+        let application_key = openapi_application_key(&payload)?;
+        let conflict_mode = if payload.conflict_mode == "skip" {
+            ImportConflictMode::Skip
+        } else {
+            ImportConflictMode::Rename
+        };
+        if job.status == ImportJobStatus::Completed {
+            let applied = self
+                .registry
+                .apply_import_job(ApplyImportJobRequest {
+                    id: job_id,
+                    workspace_id,
+                    application_key: &application_key,
+                    conflict_mode,
+                    operations: &[],
+                    finished_at: &finished_at,
+                })
+                .await?;
+            return Ok(openapi_import_response(applied, Vec::new()));
+        }
 
+        let source = import_job_source(&job.preview_payload)?;
+        let verified = self
+            .registry
+            .read_artifact_source(&self.artifact_store, workspace_id, &source.source_id)
+            .await
+            .map_err(openapi_source_error)?;
+        if verified.source.blob.artifact_ref != source.digest {
+            return Err(ApiError::source_integrity());
+        }
+        let preview = parse_verified_preview(verified.bytes, OpenApiUploadLocale::En).await?;
         let mut candidates = BTreeMap::new();
         for group in &preview.groups {
             for operation in &group.operations {
@@ -171,13 +253,6 @@ impl AdminService {
             });
         }
 
-        let finished_at = OffsetDateTime::now_utc();
-        let application_key = openapi_application_key(&payload)?;
-        let conflict_mode = if payload.conflict_mode == "skip" {
-            ImportConflictMode::Skip
-        } else {
-            ImportConflictMode::Rename
-        };
         let applied = self
             .registry
             .apply_import_job(ApplyImportJobRequest {
@@ -190,20 +265,31 @@ impl AdminService {
             })
             .await?;
 
-        let created = applied
-            .created
-            .iter()
-            .map(|operation| OpenApiImportCreatedOperation {
-                operation_id: operation.operation_id.as_str().to_owned(),
-                name: operation.name.clone(),
-                version: operation.version,
-            })
-            .collect::<Vec<_>>();
-        let mut findings = applied
-            .created
-            .iter()
-            .filter_map(|operation| {
-                operation.renamed_from.as_ref().map(|previous_name| ImportFinding {
+        Ok(openapi_import_response(applied, skipped))
+    }
+}
+
+fn openapi_import_response(
+    applied: ImportJobApplyResult,
+    mut skipped: Vec<OpenApiImportSkippedOperation>,
+) -> OpenApiImportCreateResponse {
+    let created = applied
+        .created
+        .iter()
+        .map(|operation| OpenApiImportCreatedOperation {
+            operation_id: operation.operation_id.as_str().to_owned(),
+            name: operation.name.clone(),
+            version: operation.version,
+        })
+        .collect::<Vec<_>>();
+    let mut findings = applied
+        .created
+        .iter()
+        .filter_map(|operation| {
+            operation
+                .renamed_from
+                .as_ref()
+                .map(|previous_name| ImportFinding {
                     code: "operation_name_renamed".to_owned(),
                     severity: ImportFindingSeverity::Info,
                     message: format!(
@@ -212,36 +298,171 @@ impl AdminService {
                     ),
                     operation_key: Some(operation.operation_key.clone()),
                 })
-            })
-            .collect::<Vec<_>>();
-        for operation in applied.skipped {
-            skipped.push(OpenApiImportSkippedOperation {
-                operation_key: operation.operation_key.clone(),
-                name: operation.name.clone(),
-                reason: "operation with this name already exists".to_owned(),
-            });
-            findings.push(ImportFinding {
-                code: operation.reason,
-                severity: ImportFindingSeverity::Warning,
-                message: format!(
-                    "Операция {} уже существует и была пропущена.",
-                    operation.name
-                ),
-                operation_key: Some(operation.operation_key),
+        })
+        .collect::<Vec<_>>();
+    for operation in applied.skipped {
+        skipped.push(OpenApiImportSkippedOperation {
+            operation_key: operation.operation_key.clone(),
+            name: operation.name.clone(),
+            reason: "operation with this name already exists".to_owned(),
+        });
+        findings.push(ImportFinding {
+            code: operation.reason,
+            severity: ImportFindingSeverity::Warning,
+            message: format!(
+                "Операция {} уже существует и была пропущена.",
+                operation.name
+            ),
+            operation_key: Some(operation.operation_key),
+        });
+    }
+    info!(
+        name: "admin.openapi_import.completed",
+        created = created.len(),
+        skipped = skipped.len(),
+        "openapi import created drafts"
+    );
+    OpenApiImportCreateResponse {
+        created,
+        skipped,
+        findings,
+    }
+}
+
+fn validate_openapi_upload(upload: &OpenApiUpload) -> Result<(), ApiError> {
+    if upload.bytes.is_empty() {
+        return Err(ApiError::openapi_upload(upload.locale, "empty_file"));
+    }
+    if upload.bytes.len() > MAX_ARTIFACT_BYTES {
+        return Err(ApiError::openapi_upload(upload.locale, "file_too_large"));
+    }
+    if !matches!(
+        upload.mime_type.as_str(),
+        "application/yaml"
+            | "application/x-yaml"
+            | "text/yaml"
+            | "text/x-yaml"
+            | "application/json"
+            | "application/openapi+json"
+            | "application/octet-stream"
+    ) {
+        return Err(ApiError::openapi_upload(
+            upload.locale,
+            "invalid_media_type",
+        ));
+    }
+    if std::str::from_utf8(&upload.bytes).is_err() {
+        return Err(ApiError::openapi_upload(upload.locale, "invalid_utf8"));
+    }
+    Ok(())
+}
+
+async fn parse_verified_preview(
+    bytes: Vec<u8>,
+    locale: OpenApiUploadLocale,
+) -> Result<crank_import::rest::ImportPreview, ApiError> {
+    tokio::task::spawn_blocking(move || {
+        let document = std::str::from_utf8(&bytes)
+            .map_err(|_| ApiError::openapi_upload(locale, "invalid_utf8"))?;
+        crank_import::rest::preview_document(document)
+            .map_err(|_| ApiError::openapi_upload(locale, "invalid_document"))
+    })
+    .await
+    .map_err(|_| ApiError::openapi_upload(locale, "parser_unavailable"))?
+}
+
+fn artifact_error(locale: OpenApiUploadLocale, error: ArtifactError) -> ApiError {
+    match error {
+        ArtifactError::EmptySource => ApiError::openapi_upload(locale, "empty_file"),
+        ArtifactError::SourceTooLarge => ApiError::openapi_upload(locale, "file_too_large"),
+        ArtifactError::Integrity => ApiError::openapi_upload(locale, "source_integrity"),
+        ArtifactError::Storage
+        | ArtifactError::NotFound
+        | ArtifactError::InvalidReference
+        | ArtifactError::UnsafeRoot => ApiError::openapi_upload(locale, "storage_unavailable"),
+    }
+}
+
+fn openapi_source_error(error: RegistryError) -> ApiError {
+    match error {
+        RegistryError::SourceNotFound { .. } | RegistryError::SourceUnavailable => {
+            ApiError::source_unavailable()
+        }
+        RegistryError::SourceIntegrity => ApiError::source_integrity(),
+        other => ApiError::from(other),
+    }
+}
+
+fn import_job_source(payload: &serde_json::Value) -> Result<ImportJobSourceEnvelope, ApiError> {
+    let source = payload
+        .get("source")
+        .ok_or_else(ApiError::source_unavailable)?;
+    let source_id = source
+        .get("source_id")
+        .and_then(serde_json::Value::as_str)
+        .filter(|value| value.len() <= 132)
+        .ok_or_else(ApiError::source_unavailable)?;
+    let digest = source
+        .get("digest")
+        .and_then(serde_json::Value::as_str)
+        .and_then(|value| value.parse().ok())
+        .ok_or_else(ApiError::source_integrity)?;
+    Ok(ImportJobSourceEnvelope {
+        source_id: ArtifactSourceId::new(source_id),
+        digest,
+    })
+}
+
+struct SourceDetachGuard {
+    registry: crank_registry::PostgresRegistry,
+    workspace_id: WorkspaceId,
+    source_id: ArtifactSourceId,
+    expected_updated_at: OffsetDateTime,
+    armed: bool,
+}
+
+impl SourceDetachGuard {
+    fn new(
+        registry: crank_registry::PostgresRegistry,
+        workspace_id: WorkspaceId,
+        source_id: ArtifactSourceId,
+        expected_updated_at: OffsetDateTime,
+    ) -> Self {
+        Self {
+            registry,
+            workspace_id,
+            source_id,
+            expected_updated_at,
+            armed: true,
+        }
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for SourceDetachGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let registry = self.registry.clone();
+        let workspace_id = self.workspace_id.clone();
+        let source_id = self.source_id.clone();
+        let expected_updated_at = Some(self.expected_updated_at);
+        if let Ok(handle) = tokio::runtime::Handle::try_current() {
+            handle.spawn(async move {
+                let _ = registry
+                    .detach_artifact_source(DetachArtifactSourceRequest {
+                        workspace_id: &workspace_id,
+                        source_id: &source_id,
+                        expected_updated_at,
+                        detached_at: OffsetDateTime::now_utc(),
+                    })
+                    .await;
             });
         }
-        info!(
-            name: "admin.openapi_import.completed",
-            created = created.len(),
-            skipped = skipped.len(),
-            "openapi import created drafts"
-        );
-
-        Ok(OpenApiImportCreateResponse {
-            created,
-            skipped,
-            findings,
-        })
     }
 }